Privacy Policy
This explains what Kinea does with personal data. It covers two different relationships, and the distinction matters.
Kinea is a product of Khoury Digital LLC, a limited liability company registered in Wyoming, United States.
Two roles
For a clinic’s own account — the staff who sign in, billing details, support messages — we decide how that data is used, so we are the controller. For patient records inside a clinic’s workspace, the clinic decides, and we act only on its instructions as a processor. A patient asking about their records should contact their clinic, not us.
What we hold
As controller: staff names and email addresses, the clinic’s details, subscription and payment records, support correspondence, and technical logs needed to run and secure the service. As processor: whatever the clinic records about its patients — contact details, appointments, clinical notes and payments.
Why
To provide the service, to bill for it, to support users, to keep the system secure, and to meet legal obligations. We do not sell personal data, we do not use patient records to train models, and we do not use them for advertising.
Who else is involved
We use a small number of providers to run Kinea: hosting and database infrastructure, email and messaging delivery, Paddle, our reseller for card payments, which receives the billing contact and payment details it needs to charge the card, and Anthropic, which provides the AI behind the Ask Kinea assistant. When a staff member uses Ask Kinea, their message and the records the assistant reads to answer it are sent to Anthropic; the assistant runs only after that person has agreed to this. Under our agreement with Anthropic, it does not use the data to train its models and keeps it only for a short period for safety monitoring; its processing happens outside Lebanon. Providers act on our instructions and may not use the data for their own purposes. We will tell clinics before adding a provider that handles patient data.
Where data is held
Kinea is operated from Lebanon by a company registered in the United States, and its infrastructure runs on servers outside Lebanon. A clinic in the European Union or the United Kingdom should contact us before onboarding so that the appropriate transfer safeguards and a data processing agreement are in place first.
How long
Patient records are kept while the clinic’s subscription is active and for 30 days after it ends, so the clinic can request an export. After that they are deleted from live systems, with backups ageing out on their own cycle. Billing records are kept as long as tax law requires.
Security
Access is restricted by role, each clinic’s data is isolated at the database level, and actions on clinical and financial records are logged. Data is encrypted in transit and at rest. No system is perfect; if a breach affects a clinic’s data we will tell that clinic without undue delay.
Your rights
Clinic staff may ask us for a copy of their own account data, ask us to correct it, or ask us to delete it where we are not required to keep it. Patients should direct such requests to their clinic, which controls those records; we will help the clinic answer them.
Contact
Questions about this page: anthony@peakstack.build. Khoury Digital LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States.
This page is published in English, French and Arabic. If the versions differ, the English version applies.